The EU Whistleblower Directive 2019/1937 requires member states to protect people who report breaches of certain laws. Germany and Austria implemented it in 2023. At its core is a duty for companies to offer secure reporting channels and handle reports properly.
Germany: HinSchG
The Whistleblower Protection Act has applied since 2 July 2023. Companies with generally at least 50 employees must set up an internal reporting office; for companies with 50 to 249 employees this applied from 17 December 2023. The office must confirm receipt within seven days and give feedback on measures taken within three months. Failing to set up a channel risks a fine.
Austria: HSchG
Austria’s Whistleblower Protection Act came into force in February 2023 and likewise requires companies with 50 or more employees to provide internal reporting channels, with similar deadlines for confirmation and feedback.
Switzerland: no general law
In Switzerland, a bill to protect whistleblowers under employment law failed in parliament in 2020. There is no general law; individual rules follow from employment law and sector supervision. Swiss groups with subsidiaries in the EU must, however, meet the national duties there.
Confidentiality and data protection
Reports contain personal data of the whistleblower and the person concerned. The whistleblower’s identity must be kept confidential, only competent persons may access reports, and records must be deleted after defined periods. This requires a well-designed permission and deletion concept.
Implementation in SMEs
Smaller companies can outsource the reporting office to an external provider; responsibility for handling reports remains with the company. Whether the threshold is reached is shown by a compliance assessment, together with other thresholds such as the duty to appoint a data protection officer.